Added

• Comprehensive test suite — 238 tests across 10 test files using Vitest
  • utils/security.test.ts (44 tests) — escapeIdentifier, validateQuery, isDatabaseAllowed, isSchemaAllowed, applyMasking, ensureRowLimit
  • utils/formatter.test.ts (14 tests) — markdown table formatting, ISO dates, NULL handling, truncation, JSON output
  • tools/schema.test.ts (22 tests) — all 9 schema discovery tools with access control and schema filtering
  • tools/query.test.ts (21 tests) — execute_query/execute_mutation with validation, masking, multi-server
  • tools/ddl.test.ts (11 tests) — DDL gating, blocked keywords, database access
  • tools/procedure.test.ts (18 tests) — list/describe/execute_procedure with readonly gating
  • tools/performance.test.ts (18 tests) — query plans, active queries, table/index stats, server/db info
  • tools/dba.test.ts (48 tests) — wait stats, deadlocks, blocking, backups, query store, health check
  • tools/utility.test.ts (42 tests) — compare_schemas, generate_code, ER diagram, sample_table, export_query
• npm test and npm run test:watch scripts
• Test helper utilities (tests/tools/_helpers.ts)

Changed

• Updated project docs (CLAUDE.md, workflow.md, tool-authoring.md, coding-standards.md) to reflect test availability

Full Changelog: v1.3.1...v1.3.2

Security

• Database allow/block list bypass fixed — execute_query, execute_mutation, execute_ddl, and export_query now enforce isDatabaseAllowed when the optional database parameter is supplied
• get_query_plan hardened — now extracts security from resolveServer, enforces isDatabaseAllowed and validateQuery on user-supplied SQL
• Numeric interpolation sanitized — get_wait_stats, get_space_usage, get_backup_history, get_query_store_stats, sample_table, generate_insert_scripts, and generate_test_data now validate top/count as safe integers before SQL interpolation
• describe_procedure parameterized — OBJECT_ID call now uses @param binding instead of manual single-quote escaping
• Schema allow/block list enforced — get_foreign_keys, get_indexes, get_constraints, get_triggers, and describe_procedure now check isSchemaAllowed

Fixed

• All schema.ts and procedure.ts handlers now wrapped in try/catch — errors return structured { isError: true } instead of crashing the MCP transport
• execute_ddl now accepts TRUNCATE statements (previously rejected by regex despite passing validateQuery)
• execute_procedure — added separate schema parameter and escapes schema/procedure independently (previously escapeIdentifier wrapped the entire dotted name as one identifier)
• execute_mutation — regex type check now runs before validateQuery (consistent with execute_ddl ordering)
• export_query — replaced dynamic await import() of security utilities with static imports
• generateCreateTable helper — uses escapeIdentifier() instead of raw bracket interpolation

Full Changelog: v1.3.0...v1.3.1

Multi-Server Support

Define multiple named SQL Server connections (dev, staging, prod) in a single config file and switch between them with the server parameter on any tool call. Fully backward compatible — existing single-server configs work without any changes.

New Config Format

Use connections (plural) to define multiple servers:

defaultServer: dev

connections:
  dev:
    host: dev-server.example.com
    database: MyDatabase
    authentication:
      type: sql
      user: sa
      password: DevPass123
    security:
      mode: admin
      maxRowCount: 5000

  prod:
    host: prod-server.example.com
    database: MyDatabase
    authentication:
      type: sql
      user: readonly_user
      password: ProdReadOnly
    security:
      mode: readonly
      blockedDatabases: [master, msdb, tempdb, model]

# Global security defaults (applied to all servers unless overridden)
security:
  maxRowCount: 1000
  blockedKeywords: [xp_cmdshell, SHUTDOWN, DROP DATABASE]

New Tool

server Parameter on All Tools

Every existing tool now accepts an optional server parameter:

list_tables(server: "prod", database: "MyDatabase")
health_check(server: "dev")
execute_query(server: "prod", sql: "SELECT TOP 10 * FROM Orders")
compare_schemas(server: "dev", source_database: "DevDB", target_database: "StagingDB")

Omit server to use the defaultServer from config.

Per-Server Security

Each server can have its own security configuration:

• Security mode (readonly / readwrite / admin)
• Max row count
• Blocked databases
• Allowed/blocked schemas
• Column masking rules

Global security block serves as defaults; per-server security overrides specific settings.

Architecture

• Connection pools are now keyed by server name — each server gets its own dedicated pool
• DDL tools are registered if any configured server allows DDL (per-server permission check inside each handler)
• Environment variables (MSSQL_HOST, MSSQL_PASSWORD, etc.) apply to the default server only

Files Changed

Stats

• 38 tools (37 existing + 1 new list_servers)
• 15 files changed, +681 / -245 lines
• 100% backward compatible — single-server connection format still works

Full Changelog: v1.2.3...v1.3.0

What's New

This is a major feature release adding 16 new tools (total: 37), critical security improvements, and HTTP transport support.

Security

• SQL injection protection — All queries now use parameterized inputs (@param) and escaped identifiers ([name]). Previously, user-provided values like table/schema names were interpolated via string replacement, which was vulnerable to injection. This is now fully fixed across all 37 tools.
• escapeIdentifier() helper — Centralized SQL Server bracket escaping for all object names.

New DBA & Performance Tools (9)

New Developer Utility Tools (6)

New Query Tool (1)

Improvements

• ISO date formatting — Dates now display as 2025-01-27 or 2025-01-27 14:30:00 instead of raw JavaScript Date strings like Thu Jan 27 2025 02:00:00 GMT+0200.
• Streamable HTTP transport — Start the server with --http <port> for remote hosting. Endpoints: /mcp (MCP protocol) and /health (health check). Includes CORS support.
• Comprehensive README — Detailed tool documentation with usage examples, authentication comparison table, collapsible MCP client configs.

Bug Fixes

• Fixed get_long_transactions — invalid column reference (t.name → at.name)

Files Changed

• src/tools/dba.ts — New file: 9 DBA tools + test data generator + health check
• src/tools/utility.ts — New file: schema diff, code gen, INSERT scripts, ER diagram, sampling, export
• src/tools/schema.ts — Parameterized queries + escapeIdentifier for all 9 tools
• src/tools/performance.ts — Parameterized queries + escapeIdentifier for all 7 tools
• src/tools/procedure.ts — Parameterized queries + escapeIdentifier for all 3 tools
• src/tools/query.ts — escapeIdentifier for USE statements
• src/tools/ddl.ts — escapeIdentifier for USE statements
• src/utils/security.ts — Added escapeIdentifier() export
• src/utils/formatter.ts — Added formatValue() with ISO date formatting
• src/server.ts — Register new tool modules, version bump to 1.2.0
• src/index.ts — Added --http flag and Streamable HTTP transport

Full Changelog

21 tools → 37 tools | v1.1.1 → v1.2.2